Re: [RFC DRAFT] Automatic CSRF Protection
| From: | Yasuo Ohgaki | Date: | Tue, 10 May 2016 22:05:23 +0000 |
| Subject: | Re: [RFC DRAFT] Automatic CSRF Protection | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93174@lists.php.net to get a copy of this message | ||
Hi Stas,
On Wed, May 11, 2016 at 12:32 AM, Stanislav Malyshev
<smalyshev@gmail.com> wrote:
>> What happens with applications that do not produce HTML at all, such as REST,
>> - These apps may add SESSCSRF value manually.
>
> Add where? And where that value would come from? RFC says nothing about
> that.
As usual. Query parameter when GET is used. Additional input when POST
is used. All users have to do is adding CSRF token to JS program.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net